Is it cheaper to mitigate than to debate security?

Interesting anecdote from this GigaOM story:

The former 21st Century Fox CIO realized that it was cheaper to accept the risk and pay for the mitigation rather than to pay for the lawyers to argue about the security controls they needed.